Prototype Pollution in `hapi-error`
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript
- Domain
- security
Research direction
Start at the plugin.register entry point and reproduce the three reported attack vectors from the proof of concept. Check that user-controlled keys cannot alter Object.prototype, then verify the demonstrated pollution checks no longer succeed and add coverage for the reported cases.
Written by the indexing model from the issue text.
Description
Prototype Pollution in hapi-error
Summary
hapi-error (<= 3.0.0) is vulnerable to Prototype Pollution via plugin.register.
- CWE: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes
- Severity: High (CVSS 7.5)
- Weekly Downloads: 1,997
- npm: https://www.npmjs.com/package/hapi-error
Description
The function(s) plugin.register in hapi-error do not properly restrict modifications to Object.prototype. When processing user-controlled input, an attacker can inject properties via __proto__ or constructor.prototype keys, polluting the prototype of all JavaScript objects in the application.
Attack vectors: __proto__ direct, __proto__ nested, constructor.prototype
Proof of Concept
const target = require('hapi-error');
// 1. Pollute Object.prototype
const malicious = JSON.parse('{"__proto__":{"polluted":"yes"}}');
hapi-error.plugin.register({}, malicious);
// 2. Verify pollution
const obj = {};
console.log(obj.polluted); // "yes" - prototype is polluted
console.log('Vulnerable:', obj.polluted === 'yes');
Impact
Successful exploitation allows an attacker to:
- Denial of Service (DoS) by overriding critical object methods like
toStringorhasOwnProperty - Authentication Bypass via polluted authorization checks
- Remote Code Execution (RCE) when combined with gadgets (e.g.,
child_process.spawnwithshell:truepollution)
Remediation
Add key filtering to prevent prototype pollution:
function isSafe(key) {
return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
}
Or use Object.create(null) for target objects to prevent prototype chain access.
References
- Dominant language
- JavaScript
- Stars
- 76
- Forks
- 12
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from dwyl/hapi-error
-
enhancement help wanted
Difficulty 4/5 3-5 days Newbie friendliness 25/100
dwyl/hapi-error#7 · 3 comments ·
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 60/100
quarto-dev/quarto-cli#15042 ·
Maintainers usually reply within 1 day
-
OpenCode install copies the Pi harness directory (`.pi/`) into the OpenCode config rootPossibly taken @gaurav0107 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
NaturalIntelligence/fast-xml-parser#890 · 1 comment ·
Maintainers usually reply within 3 days
-
Docs viewer: inverted grey colormap, Phantom CT window -20 to 35 HU, smoothing up to 40 mmPossibly taken A pull request linked to this issue is open or already merged. Openarea: docs enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
PyTomography/PyTomography#331 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
pnpm/get.pnpm.io#68 ·